Rakuten Mobile security vulnerabilities

Rakuten Mobile has faced multiple security concerns regarding its services and hardware. Initially, the company reported a vulnerability in its ‘my Rakuten Mobile’ service discovered during a diagnostic test. This flaw potentially allowed third parties to view payment certificates containing personal details such as names, addresses, phone numbers, data usage, and billing amounts. While the company stated that sensitive financial information and call histories were not included, and that system repairs were completed by June 20, no unauthorized access has been confirmed.

Subsequently, security vulnerabilities were identified in the Android Verified Boot (AVB) mechanism of four specific Rakuten Mobile smartphone models: the Rakuten Mini, Rakuten Hand, Rakuten Hand 5G, and Rakuten BIG s. These devices reportedly used known AOSP test keys rather than standard manufacturer-managed keys, which could allow an attacker with physical access to install a tampered system image. Because these models have reached their end-of-support lifecycle, users have been advised to switch to newer products.